Commitments
A note is a hash of value, asset, and a secret. The Merkle tree holds commitments, never plain balances. Membership in the tree is what you prove.
// Protocol
The circuits behind a quiet spend
Every private payment is a proof, not a username. These are the primitives CIPHR actually uses — named so you can verify them, not so they look decorative.
Nullifiers
Spending a note publishes a nullifier derived from the secret. Replay is impossible; linking the nullifier back to the commitment is not feasible without the key.
Stealth addresses
Each authorisation derives a one-time destination from a viewing key (EIP-5564-style). The merchant cannot tell two CIPHR payments came from one card.
zk-SNARK proofs
Proofs are generated on-device (Groth16 / PLONK family circuits over BN254). Relayers batch them so gas and IP stay off the holder.
Threshold keys
Optional recovery and freeze paths use MPC / TSS so a lost device is not automatically a lost pool — still without an issuer custodying funds.
Account abstraction
ERC-4337-style flows let a card pay without the holder holding the gas token in the clear.
What a spend proves
- You know a secret that opens some commitment in the current Merkle root.
- The nullifier has not been spent.
- The output notes and public settlement amount are consistent with the input.
- Nothing in the proof reveals which input note you used.